The Mangled FERPA Law

For those of you who may not know, FERPA stands for "Family Educational Rights and Privacy Act". It is a federal law that served to protect our children's privacy and give parents significant control over it, until 2011 when it was changed by the US Department of Education "to allow the release to third parties of student information for non-academic purposes. The rules also broaden the exceptions under which schools can release student records to non-governmental organizations without first obtaining written consent from parents."
 
I came across a video on YouTube by the US Department of Education, called "Student Privacy 101: FERPA for Parents and Students" telling us how great FERPA is:



"It provides the right for you to access that information, to seek to correct it, and generally to consent to its disclosure." [Emphasis mine.]

"FERPA requires schools and state educational agencies to keep the information that came from...records private, and get...parent's written consent before sharing it with anyone else. There are some exceptions. But the general rule, is...records are confidential." [Again, the emphasis is mine.]

The "general" parts of FERPA are the ones that parents already concretely know, or simply assume. The parts parents need to have pointed out to them are the parameters outside the "general" area. Regarding who states are allowed to share personally identifiable with, the FERPA law specifically says:

Subpart D—May an Educational Agency or Institution Disclose Personally Identifiable Information From Education Records?

§99.31 Under what conditions is prior consent not required to disclose information?
     (a) An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by §99.30 if the disclosure meets one or more of the following conditions:
          (6)(i) The disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to:
            (A) Develop, validate, or administer predictive tests;
            (B) Administer student aid programs; or
            (C) Improve instruction.

This means that as it stands now, Personally Identifiable Information can be shared with for-profit corporations, including curriculum companies, testing companies, and even Google, since they "improve instruction" with the Google Docs.

So what's the big deal? The big deal is what Personally Identifiable Information means (again, directly from the federal statute):

    §99.3 What definitions apply to these regulations?
         Personally Identifiable Information. The term includes, but is not limited to—
              (a) The student's name;
              (b) The name of the student's parent or other family members;
              (c) The address of the student or student's family;
              (d) A personal identifier, such as the student's social security number, student number, or biometric record;
              (e) Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name...

So yup, for-profit companies can have your kids' social security number if the state decides to share it.

In February 2012 the Electronic Privacy Information Center, heretofore referred to as EPIC, and which is "a public interest research center in Washington, D.C... established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values", filed a lawsuit against the US Department of Education and argued that "the agency exceeded its authority with the changes, and also that the revised regulations are not in accordance with the 1974 privacy law." However, in September 2013 a federal court dismissed the lawsuit holding that neither EPIC nor any of its Board of Director co-plaintiffs "have standing to bring the claims asserted in the complaint." You can read the details of that case here.

And you can read about how Connecticut laws make it even easier for for them to share the information, here.

And finally, come back tomorrow to read about what's currently happening with the privacy issue.